Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Yikes: You have a couple of error/issues.</p> <p><strong>SQL-injection</strong></p> <pre><code>$theID = $_GET['id']; </code></pre> <p>Fix this to</p> <pre><code>$theID = mysql_real_escape_string($_GET['id']); </code></pre> <p>To get rid of a gaping SQL-injection hole.<br> See: <a href="https://stackoverflow.com/questions/332365/xkcd-sql-injection-please-explain">How does the SQL injection from the &quot;Bobby Tables&quot; XKCD comic work?</a></p> <p><strong>XSS vulnerability</strong></p> <p>Replace this code:</p> <pre><code>echo $rowC['username']. " said: &lt;br/&gt;"; echo $rowC['comment']; </code></pre> <p>With this</p> <pre><code>$username = htmlspecialchars($rowC['username']). " said: &lt;br/&gt;"; echo $username; $comment = htmlspecialchars($rowC['comment']); echo $comment; </code></pre> <p>See: <a href="https://stackoverflow.com/questions/110575/do-htmlspecialchars-and-mysql-real-escape-string-keep-my-php-code-safe-from-injec">Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?</a><br> And: <a href="https://stackoverflow.com/questions/34896/when-is-it-best-to-sanitize-user-input">When is it Best to Sanitize User Input?</a></p> <p><strong>Error in code</strong><br> Change this: </p> <pre><code>$comments = mysql_query("SELECT * FROM comments WHERE ref = '$theID'LIMIT 0, 3;") </code></pre> <p>To this</p> <pre><code>$comments = mysql_query("SELECT * FROM comments WHERE ref = '$theID' LIMIT 0, 3") </code></pre> <p><strong>Back to the question</strong></p> <p>if you change the query to:</p> <pre><code>SELECT * FROM comments WHERE ref = '$theID' LIMIT 0, 4" </code></pre> <p>Then you can check the number of results returned. If it's 4 then display the <code>more...</code> button.</p> <p>Use this query to get 20 more results</p> <pre><code>$num_rows = mysql_num_rows($result); if $num_rows &gt; 3 { $query = "SELECT * FROM comments WHERE ref = '$theID' LIMIT 4, 20"; ... </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload